Security Leftovers
-
Security updates for Tuesday [LWN.net]
Security updates have been issued by Debian (connman, dbus, git, isc-dhcp, strongswan, and wordpress), Fedora (rubygem-pdfkit and seamonkey), Red Hat (gnutls, nettle, rh-ruby27-ruby, and rh-ruby30-ruby), SUSE (libgsasl, python, and snakeyaml), and Ubuntu (graphite2, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-raspi, linux, linux-aws, linux-bluefield, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux, linux-dell300x, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux-hwe, linux-oracle, openssh, and pcre3).
-
Living off the Cloud. Cloudy with a Chance of Exfiltration | Pen Test Partners [Ed: Microsoft TCO; the company is not compatible with the notion of security, but it's a "market leader" in NSA back doors.]
Unless default settings are changed, typical Office 365 (O365) licences come loaded with various services that are all usable by end users without special permissions. Power Automate can be used maliciously by compromised users or insider threats to systematically capture and exfiltrate data without having to contend with network safeguards.
[...]
Power Automate is an O365 service that is included with common place such as Office 365 E1, E3 and E5 that are commonly used by organisations. Power Automate can also be used with a free licence suitably named “Microsoft Power Automate Free”. Both versions come with plenty of capabilities, known as connectors. This service is a visual scripting service that allows users to automate different activities and duties to streamline processes.
The below image demonstrates the visual layout of this service, which allows you to create flows (cloud-hosted scripts) with all the typical scripting concepts such as loops, if statements, declaring variables, etc. The below example flow generates a spreadsheet with trending documents for everyone in the target group. Please note that you can only see shared documents.
-
Imperceptible and blackbox-undetectable backdoors in compiled neural networks
Early backdoor attacks against machine learning set off an arms race in attack and defence development. Defences have since appeared demonstrating some ability to detect backdoors in models or even remove them. These defences work by inspecting the training data, the model, or the integrity of the training procedure. In this work, we show that backdoors can be added during compilation, circumventing any safeguards in the data preparation and model training stages. As an illustration, the attacker can insert weight-based backdoors during the hardware compilation step that will not be detected by any training or data-preparation process. Next, we demonstrate that some backdoors, such as ImpNet, can only be reliably detected at the stage where they are inserted and removing them anywhere else presents a significant challenge. We conclude that machine-learning model security requires assurance of provenance along the entire technical pipeline, including the data, model architecture, compiler, and hardware specification.
-
ML models must also think about trusting trust | Light Blue Touchpaper
Our latest paper demonstrates how a Trojan or backdoor can be inserted into a machine-learning model by the compiler. In his Turing Award lecture, Ken Thompson explained how this could be done to an operating system, and in previous work we’d shown you you can subvert a model by manipulating the order in which training data are presented. Could these ideas be combined?
-
Cybersecurity Awareness: 4 Steps to Improve Your Security Online
According to CISA, this initiative is focused on the “people part of cybersecurity, providing information and resources to help educate CISA partners and the public, and ensure all individuals and organizations make smart decisions whether on the job, at home or at school.”
-
Tachyum Runs Native Security-Enhanced Linux to Ensure Protection of Critical Infrastructure
-
Tachyum Runs Native Security-Enhanced Linux to Ensure Protection of Critical Infrastructure
Tachyum™ today announced that Prodigy, the world’s first universal processor, successfully runs Security-Enhanced Linux (SELinux), the security architecture for Linux systems that allows administrators to have more control over who can access a system. This latest success of Tachyum’s software team helps satisfy customer requirements in many of its key markets.
-
XSAs released on 2022-10-11 | Qubes OS
The Xen Project has released one or more Xen Security Advisories (XSAs). The security of Qubes OS is not affected. Therefore, no user action is required.